Sandbox

With an xy_test_... key you work against the sandbox: same URL, same responses and same errors as production, but with example data and without touching the company's real data.

How it behaves

Reads always return the same example dataset (3 areas, 3 employees —one inactive—, vacation requests in several states, balances and time entries). Ids are stable, so you can use them in automated tests.
Writes (POST, PATCH) are validated exactly like production and return a plausible object, but nothing is stored: a later GET won't show the change, and the external_id is not stored either.
Employee import: the job is stored (test environment) so you can test the full enqueue-and-poll flow.
Webhooks: each sandbox write emits its event to the webhooks registered in the Test environment, signed with that environment's secret. Ideal for testing your receiver.
Messages and Verify: sends are real, but only to the test numbers confirmed in the panel (see Messages and Verify).
Authentication, scopes, IP allowlist, rate limit and request log behave exactly the same (using the panel's Test environment settings).

Useful example data

Data	Value
Employees (`external_id`)	`ERP-0001` (active), `ERP-0002` (active, fixed-term contract), `ERP-0003` (inactive)
Phone numbers in use	`+573000000001`, `+573000000002`, `+573000000003` → creating an employee with one of them returns `409 employee_already_exists`
Areas	Operaciones (root), Almacen (child of Operaciones), Administracion

curl "https://api.xyago.com/v1/employees?external_id=ERP-0001" \
  -H "Authorization: Bearer $XYAGO_API_KEY"

Before going live

Your integration handles every relevant error code, especially 409, 422, 429 and 502.
You follow next_cursor until it is null.
You honour Retry-After and retry with exponential backoff.
Your webhook receiver verifies the signature, answers 2xx within 10 s and drops duplicate events by id.
You log the X-Request-Id of every request.

The sandbox does not replace a test with real data: live has effects the sandbox does not reproduce (notifications to employees, calendar, the company's vacation rules). Do the first real load with a few employees.